Self XSS attack using bit.ly to grab cookies tricking users into running malicious code.
How it works?
It is a social engineering attack used to gain control of victims’ web accounts by tricking users into copying and pasting malicious content into their browsers.
Since Web browser vendors and web sites have taken steps to mitigate this attack by blocking pasting javascript tag, I figure out a way of doing that using Bit.ly, so we can create a redirect pointing to “website.com/javascript:malicious_code”.
If the user is tricked to run the javascript code after “website.com/” the cookies of its authenticated/logged session of website.com will be sent to the attacker.
Features:
Port Forwarding using Ngrok and shortner using Bitly.com (Register for free)
Also Read – Top 5 Reasons Why You Need a Custom E-commerce Website in 2020
Requirement
https://bitly.com account (Register for free)
Disclaimer:
Usage of Self-XSS for attacking targets without prior mutual consent is illegal. It’s the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
Usage:
git clone https://github.com/thelinuxchoice/self-xss
cd self-xss
bash self-xss.sh
Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…
JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…
The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…
Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…
SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…
Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…